4 ms·

This is why there is client side hashing. You still hash+salt on the server side, but the client side hashing prevents the worst kind of exposure.

• hkai 7y ago
  What's the significant difference between sending a plaintext password and a sha256(plaintext password) to the server, except if the user reuses that password on other sites?
  • eximius 7y ago
    > except if the user reuses that password on other sites Except you can't really except that.